EUVD-2026-55020
GHSA-25jm-cqq3-vxrf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable endpoint with no authentication or complexity; only confidentiality is impacted as no data is written or system availability affected.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
Articles & Coverage 1
AnalysisAI
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target site running HT Contact Form in any version before 2.9.3 with the plugin active - this is a default-enabled condition for any site that has installed the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: network-reachable, no authentication, no complexity, and high confidentiality impact due to PII exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates WordPress sites running HT Contact Form, then sends an unauthenticated HTTP GET request to the plugin's draft-retrieval endpoint - requiring only knowledge of the endpoint path, which is derivable from the plugin's public source code. The endpoint responds with stored draft data including name, email address, phone number, and physical address of form submitters. … |
| Remediation | The primary fix is to upgrade HT Contact Form to version 2.9.3 or later, which introduces proper authorization checks on the draft-retrieval endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory WordPress instances using HT Contact Form plugin versions before 2.9.3 and assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today